Upgrading the Certdog Database

DO NOT PERFORM THIS STEP ON VERSIONS 1.17 OR LATER

Contact Krestfield Support if you are unsure whether this step needs to be carried out

These instructions relate to versions 1.16 and earlier and result in a newer database being installed

These steps MUST be carried out before upgrading from version 1.16 as all future versions utilise the later database formats

Pre-requisites

You will need the database admin password. This is the password that was entered when the server was first installed.

The database must use a TLS connection. If you are using the full version, TLS is enabled by default.

For the free version before 1.16, this was not enabled.

To verify, check the [CERTDOG INSTALL]\config\application.properties file and locate the line starting spring.data.mongodb.uri. If this ends with tls=true then TLS is in use

If the URL ends with certman only, then carry out the following steps to enable TLS, otherwise skip to the next section (Backup)

To Enable TLS

Stop the Krestfield CertDog Service, then edit [CERTDOG INSTALL]\config\application.properties. At the top of the file, add ?tls=true to the end of the spring.data.mongodb.uri. For example, if you have:

spring.data.mongodb.uri=mongodb://certmanuser:1TPEwGJ2h1CBcoG0suUX@127.0.0.1/certman

Update so it looks like this:

spring.data.mongodb.uri=mongodb://certmanuser:1TPEwGJ2h1CBcoG0suUX@127.0.0.1/certman?tls=true

Next edit [CERTDOG INSTALL]\mongodb\bin\mongod.cfg adding the following to the net section:

tls:	
	mode: requireTLS
	certificateKeyFile: C:\certdog\mongodb\..\config\sslcerts\dbssl.pem
	allowConnectionsWithoutCertificates: true

E.g. if you have:

...
net:
   bindIp: 127.0.0.1
   port: 27017
setParameter:
   enableLocalhostAuthBypass: false
...   

It would become:

net:
   bindIp: 127.0.0.1
   port: 27017
   tls:
      mode: requireTLS
      certificateKeyFile: C:\certdog\mongodb\..\config\sslcerts\dbssl.pem
      allowConnectionsWithoutCertificates: true
setParameter:
   enableLocalhostAuthBypass: false

Ensuring that your path names are correct. E.g. in this example we use c:\certdog as the default installation. Update appropriately

Verify the server still starts and operates after these changes have been made

Backup

Open the services snapin and stop the following services:

Krestfield Cerdog Service
Krestfield Cerdog Database

Certdog Services

(To open the services snapin - click Start, type services and select the Services App)

Backup the current installation by copying the entire install folder. E.g. if the installation resides at c:\certdog copy (or zip up) the entire folder

Upgrade the database

Obtain the Script

Obtain the upgrade-db.ps1 script. This will be available in the [CERTDOG INSTALL]\install folder of versions 1.16 onwards

If you are intending to upgrade from version 1.16, then first obtain the latest certdog version (e.g. version 1.17) and extract the latest script from that media

Alternatively, the latest version of the script is also available here

Wherever the script is obtained from, place it in the current installations [CERTDOG INSTALL]\install folder e.g. C:\certdog\install

Run the Script

Open a PowerShell window as administrator

Navigate to [CERTDOG INSTALL]\install e.g. C:\certdog\install and run:

.\upgrade-db.ps1

This script will ask for the database admin password then perform the update

Note

The script is unaware of what updates have been made to the TLS certificates. It replaces them all with versions it knows will operate correctly

If you have have made changes to your TLS certificates - server or database, they are copied to: .\certdog\config\sslcerts.bak[TIMESTAMP] e.g. .\certdog\config\sslcerts.bak.20260226-1012 and they must then be manually coped back to the .\sslcerts folder

Troubleshooting

If the script does not complete and you see an error such as

Database dump failed. Exiting.

Verify that the admin password for the database is correct

Verify that you meet the pre-requisites mentioned at the top of this page

The script outputs the following files (located in the .\certdog\install folder:

upgradedblog.txt
upgradedblog.out

Any errors during the process will be available in these files

If the script completes OK but the system is unavailable, check if the following services are running:

Krestfield Certdog Service
Krestfield CertDog Database

If running, restart the Krestfield Certdog Database, followed by the Krestfield Certdog Service

If they were not running. First attempt to start the services in the same order. If they fail to start perform the following:

Navigate to .\certdog\mongodb\bin and open mongod.cfg

...
net:
   bindIp: 127.0.0.1
   port: 27017
   tls:
        mode: requireTLS
        certificateKeyFile: C:\certdog\mongodb\..\config\sslcerts\dbssl.pem
        CAFile: C:\certdog\mongodb\..\config\sslcerts\dbssl_root.pem
        CAFile: C:\certdog\mongodb\..\config\sslcerts\dbssl_root.pem
		allowConnectionsWithoutCertificates: true
setParameter:
   enableLocalhostAuthBypass: false
replication:
   replSetName: replocal
security:
   authorization: "enabled"
   clusterAuthMode: x509
   clusterAuthMode: x509   

If you see any duplicate lines, remove the duplicates. For example, in this example, there are duplicates for CAFile:

        CAFile: C:\certdog\mongodb\..\config\sslcerts\dbssl_root.pem
        CAFile: C:\certdog\mongodb\..\config\sslcerts\dbssl_root.pem

and clusterAuthMode:

   clusterAuthMode: x509
   clusterAuthMode: x509  

So remove the duplicate items so there is only one CAFile:

        CAFile: C:\certdog\mongodb\..\config\sslcerts\dbssl_root.pem

and one clusterAuthMode:

   clusterAuthMode: x509

Do this for any other duplicates found.

Save the mongod.cfg file and attempt to start the services in this order:

Krestfield CertDog Database
Krestfield Certdog Service

If the upgrade does fail and cannot be recovered, rollback the installation by stopping the services and re-placing the install with the backed up files (as carried out in the Backup section above). Once restored, re-start the services